Feeds

'Hacked' estate agency Foxtons breaks glass, pulls password reset cord

10,000 account logins feared leaked all over the web

SANS - Survey on application security programs

Trendy UK estate agency Foxtons pushed the big red password reset button, as a precaution, after it appeared hackers lifted thousands of clients' usernames and passwords from its systems.

Miscreants claimed to have leaked online user names, email addresses and passwords of nearly 10,000 Foxtons’ customers, Estate Agent Today reports. The supposed logins to MyFoxtons web portal, some partially obscured, were uploaded to Pastebin.

The list was quickly pulled but the assumption has to be that copies were made before this happened. Anyone with access to the list, whose authenticity remains unconfirmed, may have been able to log into Foxtons' systems and access all sorts of sensitive information such as addresses, phone numbers and rent payment details. This wouldn't include credit card or bank details but it would still provide rich fodder for follow-up social engineering attacks.

In an advisory to customers on Tuesday, forwarded to El Reg by readers, Foxtons said it was investigating the purported hack. In the meantime it had reset user passwords as a precaution:

We have been able to download the list of usernames and passwords that were posted and are currently running checks to determine its veracity. Please be assured though that any sensitive information, including credit card information that you may have provided in relation to payments made through Foxtons is completely secure with our external payment providers.

Immediate action, however, has been taken to safeguard your account and an investigation will continue. Should your account be upon the list, you will be contacted directly by our Team.

Whilst this investigation is underway, we are unwilling to run the risk that any live MyFoxtons account is upon the list and have initiated a trigger to reset user passwords upon your next successful login. It is not necessary to do this straight away, just the next time you want to use the account.

We asked a Foxtons representative whether the company hashed or salted stored passwords, a basic security practice. The rep declined to comment on any aspects of the incident beyond saying that it may decide to issue a statement at some point.

Ross Parsell, director of cyber security at Thales UK, said that tighter regulation might be needed to stem the growing list of data breaches.

“The recent spate of high-profile data breaches, such as this alleged attack on Foxtons, are evidence that organisations are either not taking cyber security seriously or are bewildered by the problem. Regulation in this case is a necessity to alter corporate behaviour." ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.